honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove combo security and license helper from license state (#55366) (#55417) 

Security features in the license state currently do a dynamic check on
whether security is enabled. This is because the license level can
change the default security enabled state. This commit splits out the
check on security being enabled, so that the combo method of security
enabled plus license allowed is no longer necessary.
This commit is contained in:
Ryan Ernst 2020-04-17 13:07:02 -07:00 committed by GitHub
parent 49e30b15a2
commit 66071b2f6e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
37 changed files with 61 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java
View File

@ -402,11 +402,11 @@ public class XPackLicenseState {
}
public boolean isIpFilteringAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.GOLD, false);
return isAllowedByLicense(OperationMode.GOLD, false);
}
public boolean isAuditingAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.GOLD, false);
return isAllowedByLicense(OperationMode.GOLD, false);
}
public boolean isStatsAndHealthAllowed() {
@ -427,33 +427,33 @@ public class XPackLicenseState {
* @return {@code true} to enable DLS and FLS. Otherwise {@code false}.
*/
public boolean isDocumentAndFieldLevelSecurityAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.PLATINUM, false);
return isAllowedByLicense(OperationMode.PLATINUM, false);
}
public boolean areAllRealmsAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.PLATINUM, false);
return isAllowedByLicense(OperationMode.PLATINUM, false);
}
public boolean areStandardRealmsAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.GOLD, false);
return isAllowedByLicense(OperationMode.GOLD, false);
}
public boolean isCustomRoleProvidersAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.PLATINUM, true);
return isAllowedByLicense(OperationMode.PLATINUM, true);
}
/**
* Whether the Elasticsearch {@code TokenService} is allowed
*/
public boolean isTokenServiceAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.GOLD, false);
return isAllowedByLicense(OperationMode.GOLD, false);
}
/**
* Whether the Elasticsearch {@code ApiKeyService} is allowed
*/
public boolean isApiKeyServiceAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.MISSING, false);
return isAllowedByLicense(OperationMode.MISSING, false);
}
/**
@ -461,7 +461,7 @@ public class XPackLicenseState {
* @see org.elasticsearch.xpack.core.security.authc.support.DelegatedAuthorizationSettings
*/
public boolean isAuthorizationRealmAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.PLATINUM, true);
return isAllowedByLicense(OperationMode.PLATINUM, true);
}
/**
@ -469,7 +469,7 @@ public class XPackLicenseState {
* @see org.elasticsearch.xpack.core.security.authc.support.DelegatedAuthorizationSettings
*/
public boolean isAuthorizationEngineAllowed() {
return isAllowedBySecurityAndLicense(OperationMode.PLATINUM, true);
return isAllowedByLicense(OperationMode.PLATINUM, true);
}
public boolean isWatcherAllowed() {
@ -683,32 +683,7 @@ public class XPackLicenseState {
}
/**
* Test whether a feature is allowed by the status of license and security configuration.
* Note the difference to {@link #isAllowedByLicense(OperationMode, boolean)}
* is this method requires security to be enabled.
*
* @param minimumMode The minimum license to meet or exceed
* @param needActive Whether current license needs to be active.
*
* @return true if feature is allowed, otherwise false
*/
private boolean isAllowedBySecurityAndLicense(OperationMode minimumMode, boolean needActive) {
return checkAgainstStatus(status -> {
if (false == isSecurityEnabled(status.mode, isSecurityExplicitlyEnabled, isSecurityEnabled)) {
return false;
}
// Do not delegate to isAllowedByLicense as it also captures "status" which may be different from here
if (needActive && false == status.active) {
return false;
}
return isAllowedByOperationMode(status.mode, minimumMode);
});
}
/**
* Test whether a feature is allowed by the status of license. Note difference to
* {@link #isAllowedBySecurityAndLicense} is this method does <b>Not</b> require security
* to be enabled.
* Test whether a feature is allowed by the status of license.
*
* @param minimumMode The minimum license to meet or exceed
* @param needActive Whether current license needs to be active

2
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/accesscontrol/SecurityIndexReaderWrapper.java
View File

@ -61,7 +61,7 @@ public class SecurityIndexReaderWrapper implements CheckedFunction<DirectoryRead
@Override
public DirectoryReader apply(final DirectoryReader reader) {
if (licenseState.isDocumentAndFieldLevelSecurityAllowed() == false) {
if (licenseState.isSecurityEnabled() == false || licenseState.isDocumentAndFieldLevelSecurityAllowed() == false) {
return reader;
}

9
x-pack/plugin/core/src/test/java/org/elasticsearch/license/XPackLicenseStateTests.java
View File

@ -107,7 +107,7 @@ public class XPackLicenseStateTests extends ESTestCase {
assertThat(licenseState.isDocumentAndFieldLevelSecurityAllowed(), is(false));
assertThat(licenseState.isCustomRoleProvidersAllowed(), is(false));
assertThat(licenseState.isTokenServiceAllowed(), is(false));
assertThat(licenseState.isApiKeyServiceAllowed(), is(false));
assertThat(licenseState.isApiKeyServiceAllowed(), is(true));
assertThat(licenseState.isSecurityAvailable(), is(true));
assertThat(licenseState.isSecurityEnabled(), is(false));
@ -142,7 +142,7 @@ public class XPackLicenseStateTests extends ESTestCase {
assertThat(licenseState.isDocumentAndFieldLevelSecurityAllowed(), is(false));
assertThat(licenseState.isCustomRoleProvidersAllowed(), is(false));
assertThat(licenseState.isTokenServiceAllowed(), is(false));
assertThat(licenseState.isApiKeyServiceAllowed(), is(false));
assertThat(licenseState.isApiKeyServiceAllowed(), is(true));
}
public void testSecurityEnabledBasicExpired() {
@ -260,11 +260,6 @@ public class XPackLicenseStateTests extends ESTestCase {
private void assertSecurityNotAllowed(XPackLicenseState licenseState) {
assertThat(licenseState.isSecurityEnabled(), is(false));
assertThat(licenseState.isIpFilteringAllowed(), is(false));
assertThat(licenseState.isAuditingAllowed(), is(false));
assertThat(licenseState.isStatsAndHealthAllowed(), is(true));
assertThat(licenseState.isDocumentAndFieldLevelSecurityAllowed(), is(false));
assertThat(licenseState.isCustomRoleProvidersAllowed(), is(false));
}
public void testSecurityAckBasicToNotGoldOrStandard() {

2
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/accesscontrol/SecurityIndexReaderWrapperIntegrationTests.java
View File

@ -97,6 +97,7 @@ public class SecurityIndexReaderWrapperIntegrationTests extends AbstractBuilderT
QueryShardContext queryShardContext = spy(realQueryShardContext);
DocumentSubsetBitsetCache bitsetCache = new DocumentSubsetBitsetCache(Settings.EMPTY, Executors.newSingleThreadExecutor());
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(true);
Directory directory = newDirectory();
@ -232,6 +233,7 @@ public class SecurityIndexReaderWrapperIntegrationTests extends AbstractBuilderT
DocumentSubsetBitsetCache bitsetCache = new DocumentSubsetBitsetCache(Settings.EMPTY, Executors.newSingleThreadExecutor());
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(true);
SecurityIndexReaderWrapper wrapper = new SecurityIndexReaderWrapper(s -> queryShardContext,
bitsetCache, securityContext, licenseState, scriptService) {

1
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/accesscontrol/SecurityIndexReaderWrapperUnitTests.java
View File

@ -64,6 +64,7 @@ public class SecurityIndexReaderWrapperUnitTests extends ESTestCase {
ShardId shardId = new ShardId(index, 0);
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(true);
securityContext = new SecurityContext(Settings.EMPTY, new ThreadContext(Settings.EMPTY));
IndexShard indexShard = mock(IndexShard.class);

3
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java
View File

@ -1029,7 +1029,8 @@ public class Security extends Plugin implements SystemIndexPlugin, IngestPlugin,
public Function<String, Predicate<String>> getFieldFilter() {
if (enabled) {
return index -> {
if (getLicenseState().isDocumentAndFieldLevelSecurityAllowed() == false) {
XPackLicenseState licenseState = getLicenseState();
if (licenseState.isSecurityEnabled() == false || licenseState.isDocumentAndFieldLevelSecurityAllowed() == false) {
return MapperPlugin.NOOP_FIELD_PREDICATE;
}
IndicesAccessControl indicesAccessControl = threadContext.get().getTransient(

3
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/AuditTrailService.java
View File

@ -31,7 +31,8 @@ public class AuditTrailService {
}
public AuditTrail get() {
if (compositeAuditTrail.isEmpty() == false && licenseState.isAuditingAllowed()) {
if (compositeAuditTrail.isEmpty() == false &&
licenseState.isSecurityEnabled() && licenseState.isAuditingAllowed()) {
return compositeAuditTrail;
} else {
return NOOP_AUDIT_TRAIL;

4
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/ApiKeyService.java
View File

@ -581,11 +581,11 @@ public class ApiKeyService {
}
private boolean isEnabled() {
return enabled && licenseState.isApiKeyServiceAllowed();
return enabled && licenseState.isSecurityEnabled() && licenseState.isApiKeyServiceAllowed();
}
public void ensureEnabled() {
if (licenseState.isApiKeyServiceAllowed() == false) {
if (licenseState.isSecurityEnabled() == false || licenseState.isApiKeyServiceAllowed() == false) {
throw LicenseUtils.newComplianceException("api keys");
}
if (enabled == false) {

4
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
View File

@ -1519,11 +1519,11 @@ public final class TokenService {
}
private boolean isEnabled() {
return enabled && licenseState.isTokenServiceAllowed();
return enabled && licenseState.isSecurityEnabled() && licenseState.isTokenServiceAllowed();
}
private void ensureEnabled() {
if (licenseState.isTokenServiceAllowed() == false) {
if (licenseState.isSecurityEnabled() == false || licenseState.isTokenServiceAllowed() == false) {
throw LicenseUtils.newComplianceException("security tokens");
}
if (enabled == false) {

3
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/support/DelegatedAuthorizationSupport.java
View File

@ -80,7 +80,8 @@ public class DelegatedAuthorizationSupport {
* with a meaningful diagnostic message.
*/
public void resolve(String username, ActionListener<AuthenticationResult> resultListener) {
if (licenseState.isAuthorizationRealmAllowed() == false) {
boolean authzOk = licenseState.isSecurityEnabled() && licenseState.isAuthorizationRealmAllowed();
if (authzOk == false) {
resultListener.onResponse(AuthenticationResult.unsuccessful(
DelegatedAuthorizationSettings.AUTHZ_REALMS_SUFFIX + " are not permitted",
LicenseUtils.newComplianceException(DelegatedAuthorizationSettings.AUTHZ_REALMS_SUFFIX)

2
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java
View File

@ -365,7 +365,7 @@ public class AuthorizationService {
}
private AuthorizationEngine getAuthorizationEngineForUser(final User user) {
if (rbacEngine != authorizationEngine && licenseState.isAuthorizationEngineAllowed()) {
if (rbacEngine != authorizationEngine && licenseState.isSecurityEnabled() && licenseState.isAuthorizationEngineAllowed()) {
if (ClientReservedRealm.isReserved(user.principal(), settings) || isInternalUser(user)) {
return rbacEngine;
} else {

3
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/interceptor/BulkShardRequestInterceptor.java
View File

@ -40,7 +40,8 @@ public class BulkShardRequestInterceptor implements RequestInterceptor {
@Override
public void intercept(RequestInfo requestInfo, AuthorizationEngine authzEngine, AuthorizationInfo authorizationInfo,
ActionListener<Void> listener) {
if (requestInfo.getRequest() instanceof BulkShardRequest && licenseState.isDocumentAndFieldLevelSecurityAllowed()) {
boolean shouldIntercept = licenseState.isSecurityEnabled() && licenseState.isDocumentAndFieldLevelSecurityAllowed();
if (requestInfo.getRequest() instanceof BulkShardRequest && shouldIntercept) {
IndicesAccessControl indicesAccessControl = threadContext.getTransient(AuthorizationServiceField.INDICES_PERMISSIONS_KEY);
final BulkShardRequest bulkShardRequest = (BulkShardRequest) requestInfo.getRequest();

3
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/interceptor/FieldAndDocumentLevelSecurityRequestInterceptor.java
View File

@ -38,7 +38,8 @@ abstract class FieldAndDocumentLevelSecurityRequestInterceptor implements Reques
ActionListener<Void> listener) {
if (requestInfo.getRequest() instanceof IndicesRequest) {
IndicesRequest indicesRequest = (IndicesRequest) requestInfo.getRequest();
if (supports(indicesRequest) && licenseState.isDocumentAndFieldLevelSecurityAllowed()) {
boolean shouldIntercept = licenseState.isSecurityEnabled() && licenseState.isDocumentAndFieldLevelSecurityAllowed();
if (supports(indicesRequest) && shouldIntercept) {
final IndicesAccessControl indicesAccessControl =
threadContext.getTransient(AuthorizationServiceField.INDICES_PERMISSIONS_KEY);
for (String index : indicesRequest.indices()) {

2
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/filter/IPFilter.java
View File

@ -199,7 +199,7 @@ public class IPFilter {
}
public boolean accept(String profile, InetSocketAddress peerAddress) {
if (licenseState.isIpFilteringAllowed() == false) {
if (licenseState.isSecurityEnabled() == false || licenseState.isIpFilteringAllowed() == false) {
return true;
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/oidc/TransportOpenIdConnectLogoutActionTests.java
View File

@ -177,6 +177,7 @@ public class TransportOpenIdConnectLogoutActionTests extends OpenIdConnectTestCa
final ClusterService clusterService = ClusterServiceUtils.createClusterService(threadPool);
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isTokenServiceAllowed()).thenReturn(true);
tokenService = new TokenService(settings, Clock.systemUTC(), client, licenseState, new SecurityContext(settings, threadContext),

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/saml/TransportSamlInvalidateSessionActionTests.java
View File

@ -204,6 +204,7 @@ public class TransportSamlInvalidateSessionActionTests extends SamlTestCase {
when(securityIndex.freeze()).thenReturn(securityIndex);
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isTokenServiceAllowed()).thenReturn(true);
final ClusterService clusterService = ClusterServiceUtils.createClusterService(threadPool);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/saml/TransportSamlLogoutActionTests.java
View File

@ -207,6 +207,7 @@ public class TransportSamlLogoutActionTests extends SamlTestCase {
when(securityIndex.freeze()).thenReturn(securityIndex);
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isTokenServiceAllowed()).thenReturn(true);
final ClusterService clusterService = ClusterServiceUtils.createClusterService(threadPool);
final SecurityContext securityContext = new SecurityContext(settings, threadContext);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/token/TransportCreateTokenActionTests.java
View File

@ -168,6 +168,7 @@ public class TransportCreateTokenActionTests extends ESTestCase {
this.clusterService = ClusterServiceUtils.createClusterService(threadPool);
this.license = mock(XPackLicenseState.class);
when(license.isSecurityEnabled()).thenReturn(true);
when(license.isTokenServiceAllowed()).thenReturn(true);
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/token/TransportInvalidateTokenActionTests.java
View File

@ -73,6 +73,7 @@ public class TransportInvalidateTokenActionTests extends ESTestCase {
securityIndex = mock(SecurityIndexManager.class);
this.clusterService = ClusterServiceUtils.createClusterService(threadPool);
this.license = mock(XPackLicenseState.class);
when(license.isSecurityEnabled()).thenReturn(true);
when(license.isTokenServiceAllowed()).thenReturn(true);
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/audit/AuditTrailServiceTests.java
View File

@ -50,6 +50,7 @@ public class AuditTrailServiceTests extends ESTestCase {
licenseState = mock(XPackLicenseState.class);
service = new AuditTrailService(auditTrails, licenseState);
isAuditingAllowed = randomBoolean();
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuditingAllowed()).thenReturn(isAuditingAllowed);
token = mock(AuthenticationToken.class);
request = mock(TransportRequest.class);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ApiKeyServiceTests.java
View File

@ -98,6 +98,7 @@ public class ApiKeyServiceTests extends ESTestCase {
@Before
public void setupMocks() {
this.licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isApiKeyServiceAllowed()).thenReturn(true);
this.client = mock(Client.class);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/TokenServiceTests.java
View File

@ -142,6 +142,7 @@ public class TokenServiceTests extends ESTestCase {
// License state (enabled by default)
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isTokenServiceAllowed()).thenReturn(true);
// version 7.2 was an "inflection" point in the Token Service development (access_tokens as UUIDS, multiple concurrent refreshes,

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/kerberos/KerberosRealmTestCase.java
View File

@ -83,6 +83,7 @@ public abstract class KerberosRealmTestCase extends ESTestCase {
settings = buildKerberosRealmSettings(REALM_NAME,
writeKeyTab(dir.resolve("key.keytab"), "asa").toString(), 100, "10m", true, randomBoolean());
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationRealmAllowed()).thenReturn(true);
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ldap/LdapRealmTests.java
View File

@ -106,6 +106,7 @@ public class LdapRealmTests extends LdapTestCase {
defaultGlobalSettings = builder.put("path.home", createTempDir()).build();
sslService = new SSLService(defaultGlobalSettings, TestEnvironment.newEnvironment(defaultGlobalSettings));
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationRealmAllowed()).thenReturn(true);
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectRealmTests.java
View File

@ -380,6 +380,7 @@ public class OpenIdConnectRealmTests extends OpenIdConnectTestCase {
private void initializeRealms(Realm... realms) {
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationRealmAllowed()).thenReturn(true);
final List<Realm> realmList = Arrays.asList(realms);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/pki/PkiRealmTests.java
View File

@ -74,6 +74,7 @@ public class PkiRealmTests extends ESTestCase {
.put("path.home", createTempDir())
.build();
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationRealmAllowed()).thenReturn(true);
}

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/saml/SamlRealmTests.java
View File

@ -296,6 +296,7 @@ public class SamlRealmTests extends SamlTestCase {
private void initializeRealms(Realm... realms) {
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationRealmAllowed()).thenReturn(true);
final List<Realm> realmList = Arrays.asList(realms);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/support/DelegatedAuthorizationSupportTests.java
View File

@ -188,6 +188,7 @@ public class DelegatedAuthorizationSupportTests extends ESTestCase {
private XPackLicenseState getLicenseState(boolean authzRealmsAllowed) {
final XPackLicenseState license = mock(XPackLicenseState.class);
when(license.isSecurityEnabled()).thenReturn(true);
when(license.isAuthorizationRealmAllowed()).thenReturn(authzRealmsAllowed);
return license;
}

2
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizationServiceTests.java
View File

@ -203,6 +203,7 @@ public class AuthorizationServiceTests extends ESTestCase {
when(clusterService.state()).thenReturn(ClusterState.EMPTY_STATE);
auditTrail = mock(AuditTrail.class);
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuditingAllowed()).thenReturn(true);
auditTrailService = new AuditTrailService(Collections.singletonList(auditTrail), licenseState);
threadContext = new ThreadContext(settings);
@ -1454,6 +1455,7 @@ public class AuthorizationServiceTests extends ESTestCase {
};
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isAuthorizationEngineAllowed()).thenReturn(true);
authorizationService = new AuthorizationService(Settings.EMPTY, rolesStore, clusterService,
auditTrailService, new DefaultAuthenticationFailureHandler(Collections.emptyMap()), threadPool,

7
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/SecuritySearchOperationListenerTests.java
View File

@ -29,6 +29,7 @@ import org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.Authoriza
import org.elasticsearch.xpack.core.security.user.User;
import org.elasticsearch.xpack.security.audit.AuditTrail;
import org.elasticsearch.xpack.security.audit.AuditTrailService;
import org.mockito.Mockito;
import java.util.Collections;
@ -133,7 +134,7 @@ public class SecuritySearchOperationListenerTests extends ESTestCase {
SearchContextMissingException expected =
expectThrows(SearchContextMissingException.class, () -> listener.validateSearchContext(testSearchContext, request));
assertEquals(testSearchContext.id(), expected.contextId());
verify(licenseState, times(3)).isSecurityEnabled();
verify(licenseState, Mockito.atLeast(3)).isSecurityEnabled();
verify(auditTrail).accessDenied(eq(null), eq(authentication), eq("action"), eq(request),
authzInfoRoles(authentication.getUser().roles()));
}
@ -150,7 +151,7 @@ public class SecuritySearchOperationListenerTests extends ESTestCase {
threadContext.putTransient(ORIGINATING_ACTION_KEY, "action");
final InternalScrollSearchRequest request = new InternalScrollSearchRequest();
listener.validateSearchContext(testSearchContext, request);
verify(licenseState, times(4)).isSecurityEnabled();
verify(licenseState, Mockito.atLeast(4)).isSecurityEnabled();
verifyNoMoreInteractions(auditTrail);
}
@ -169,7 +170,7 @@ public class SecuritySearchOperationListenerTests extends ESTestCase {
SearchContextMissingException expected =
expectThrows(SearchContextMissingException.class, () -> listener.validateSearchContext(testSearchContext, request));
assertEquals(testSearchContext.id(), expected.contextId());
verify(licenseState, times(5)).isSecurityEnabled();
verify(licenseState, Mockito.atLeast(5)).isSecurityEnabled();
verify(auditTrail).accessDenied(eq(null), eq(authentication), eq("action"), eq(request),
authzInfoRoles(authentication.getUser().roles()));
}

2
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
View File

@ -117,6 +117,7 @@ public class CompositeRolesStoreTests extends ESTestCase {
public void testRolesWhenDlsFlsUnlicensed() throws IOException {
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(false);
RoleDescriptor flsRole = new RoleDescriptor("fls", null, new IndicesPrivileges[] {
IndicesPrivileges.builder()
@ -187,6 +188,7 @@ public class CompositeRolesStoreTests extends ESTestCase {
public void testRolesWhenDlsFlsLicensed() throws IOException {
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(true);
RoleDescriptor flsRole = new RoleDescriptor("fls", null, new IndicesPrivileges[] {
IndicesPrivileges.builder()

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/FileRolesStoreTests.java
View File

@ -287,6 +287,7 @@ public class FileRolesStoreTests extends ESTestCase {
List<String> events = CapturingLogger.output(logger.getName(), Level.WARN);
events.clear();
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(false);
Map<String, RoleDescriptor> roles = FileRolesStore.parseFile(path, logger, Settings.EMPTY, licenseState, xContentRegistry());
assertThat(roles, notNullValue());

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/NativeRolesStoreTests.java
View File

@ -94,6 +94,7 @@ public class NativeRolesStoreTests extends ESTestCase {
public void testRoleDescriptorWithFlsDlsLicensing() throws IOException {
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isDocumentAndFieldLevelSecurityAllowed()).thenReturn(false);
RoleDescriptor flsRole = new RoleDescriptor("fls", null,
new IndicesPrivileges[] { IndicesPrivileges.builder().privileges("READ").indices("*")

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/test/SecurityMocks.java
View File

@ -172,6 +172,7 @@ public final class SecurityMocks {
final Client client = mock(Client.class);
when(client.threadPool()).thenReturn(threadPool);
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isTokenServiceAllowed()).thenReturn(true);
final ClusterService clusterService = mock(ClusterService.class);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/filter/IPFilterTests.java
View File

@ -60,6 +60,7 @@ public class IPFilterTests extends ESTestCase {
@Before
public void init() {
licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isIpFilteringAllowed()).thenReturn(true);
when(licenseState.isAuditingAllowed()).thenReturn(true);
auditTrail = mock(AuditTrail.class);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/netty4/IpFilterRemoteAddressFilterTests.java
View File

@ -56,6 +56,7 @@ public class IpFilterRemoteAddressFilterTests extends ESTestCase {
IPFilter.PROFILE_FILTER_ALLOW_SETTING,
IPFilter.PROFILE_FILTER_DENY_SETTING)));
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isIpFilteringAllowed()).thenReturn(true);
AuditTrailService auditTrailService = new AuditTrailService(Collections.emptyList(), licenseState);
IPFilter ipFilter = new IPFilter(settings, auditTrailService, clusterSettings, licenseState);

1
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/nio/NioIPFilterTests.java
View File

@ -59,6 +59,7 @@ public class NioIPFilterTests extends ESTestCase {
IPFilter.PROFILE_FILTER_ALLOW_SETTING,
IPFilter.PROFILE_FILTER_DENY_SETTING)));
XPackLicenseState licenseState = mock(XPackLicenseState.class);
when(licenseState.isSecurityEnabled()).thenReturn(true);
when(licenseState.isIpFilteringAllowed()).thenReturn(true);
AuditTrailService auditTrailService = new AuditTrailService(Collections.emptyList(), licenseState);
ipFilter = new IPFilter(settings, auditTrailService, clusterSettings, licenseState);